What causes "ERROR: Elasticsearch keystore not found" in elastic/elasticsearch?

Run `bin/elasticsearch-keystore create` to initialize a keystore if one is expected.

elastic/elasticsearch · warning · UserException

1

1

Error message

ERROR: Elasticsearch keystore not found

What it means

Thrown by `elasticsearch-keystore has-password` when `KeyStoreWrapper.load(configDir)` returns null — i.e. no keystore file exists in the config directory. The error text is printed to stderr via `terminal.errorPrintln` (respecting the `--silent` flag) and the thrown UserException carries a null message with NO_PASSWORD_EXIT_CODE (1). It is an intentional semantic exit: the subcommand exists purely to report password status.

Source

Thrown at distribution/tools/keystore-cli/src/main/java/org/elasticsearch/cli/keystore/HasPasswordKeyStoreCommand.java:42

    static final int NO_PASSWORD_EXIT_CODE = 1;

    HasPasswordKeyStoreCommand() {
        super(
            "Succeeds if the keystore exists and is password-protected, " + "fails with exit code " + NO_PASSWORD_EXIT_CODE + " otherwise."
        );
    }

    @Override
    public void execute(Terminal terminal, OptionSet options, Environment env, ProcessInfo processInfo) throws Exception {
        final Path configFile = env.configDir();
        final KeyStoreWrapper keyStore = KeyStoreWrapper.load(configFile);

        // We handle error printing here so we can respect the "--silent" flag
        // We have to throw an exception to get a nonzero exit code
        if (keyStore == null) {
            terminal.errorPrintln(Terminal.Verbosity.NORMAL, "ERROR: Elasticsearch keystore not found");
            throw new UserException(NO_PASSWORD_EXIT_CODE, null);
        }
        if (keyStore.hasPassword() == false) {
            terminal.errorPrintln(Terminal.Verbosity.NORMAL, "ERROR: Keystore is not password-protected");
            throw new UserException(NO_PASSWORD_EXIT_CODE, null);
        }

        terminal.println(Terminal.Verbosity.NORMAL, "Keystore is password-protected");
    }
}

View on GitHub (pinned to db6a809a66)

Solutions

Run `bin/elasticsearch-keystore create` to initialize a keystore if one is expected.
If a keystore should already exist, verify `ES_PATH_CONF` and locate `elasticsearch.keystore`.
Treat exit code 1 from `has-password` as 'no keystore' and branch accordingly in automation.

Defensive patterns

Strategy: try-catch

Validate before calling

Path ks = KeyStoreWrapper.keystorePath(env.configDir());
boolean exists = Files.exists(ks);

Try / catch

int rc = runHasPassword();
if (rc == 1) {
    // no keystore (or no password) — create/initialize as needed
}

Prevention

Treat exit 1 from has-password as a normal 'unprotected or absent' signal, not a crash.
Run has-password as part of bootstrap checks to decide whether to create a keystore.

When it happens

Trigger: Running `has-password` on a node that has no keystore; pointing at the wrong config dir; checking a fresh install before `create`.

Common situations: Health-check scripts probing whether to set up a keystore; CI verifying cluster bootstrap state.

Related errors

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/1f159dc9637dcc2d. Report an issue: GitHub.